M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity

Back


Id	779731f7-8ba0-4198-8524-5701b7defddc
Rulename	M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity
Description	This content is employed to correlate with Microsoft 365 Defender phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.
Severity	Medium
Tactics	PrivilegeEscalation
Techniques	T1078
Required data connectors	CheckPoint Fortinet OfficeATP PaloAltoNetworks Zscaler
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/SucessfullSiginFromPhingLink.yaml
Version	1.0.3
Arm template	779731f7-8ba0-4198-8524-5701b7defddc.json

KQL

let Alert_List= dynamic([
"Phishing link click observed in Network Traffic",
"Phish delivered due to an IP allow policy",
"A potentially malicious URL click was detected",
"High Risk Sign-in Observed in Network Traffic",
"A user clicked through to a potentially malicious URL",
"Suspicious network connection to AitM phishing site",
"Messages containing malicious entity not removed after delivery",
"Email messages containing malicious URL removed after delivery",
"Email reported by user as malware or phish",
"Phish delivered due to an ETR override",
"Phish not zapped because ZAP is disabled"]);
SecurityAlert
| where AlertName in~ (Alert_List)
//Findling Alerts which has the URL
| where Entities has "url"
//extracting Entities
| extend Entities = parse_json(Entities)
| mv-apply Entity = Entities on
    (
    where Entity.Type == 'url'
    | extend EntityUrl = tostring(Entity.Url)
    )
| summarize
    Url=tostring(tolower(take_any(EntityUrl))),
    AlertTime= min(TimeGenerated),
    make_set(SystemAlertId, 100)
    by ProductName, AlertName
// matching with 3rd party network logs and 3p Alerts
| join kind= inner (CommonSecurityLog
    | where DeviceVendor has_any  ("Palo Alto Networks", "Fortinet", "Check Point", "Zscaler")
    | where DeviceProduct startswith "FortiGate" or DeviceProduct startswith  "PAN" or DeviceProduct startswith  "VPN" or DeviceProduct startswith "FireWall" or DeviceProduct startswith  "NSSWeblog" or DeviceProduct startswith "URL"
    | where DeviceAction != "Block"
    | where isnotempty(RequestURL)
    | project
        3plogTime=TimeGenerated,
        DeviceVendor,
        DeviceProduct,
        Activity,
        DestinationHostName,
        DestinationIP,
        RequestURL=tostring(tolower(RequestURL)),
        MaliciousIP,
        SourceUserName=tostring(tolower(SourceUserName)),
        IndicatorThreatType,
        ThreatSeverity,
        ThreatConfidence,
        SourceUserID,
        SourceHostName)
    on $left.Url == $right.RequestURL
// matching successful Login from suspicious IP
| join kind=inner (SigninLogs
    //filtering the Successful Login
    | where ResultType == 0
    | project
        IPAddress,
        SourceSystem,
        SigniningTime= TimeGenerated,
        OperationName,
        ResultType,
        ResultDescription,
        AlternateSignInName,
        AppDisplayName,
        AuthenticationRequirement,
        ClientAppUsed,
        RiskState,
        RiskLevelDuringSignIn,
        UserPrincipalName=tostring(tolower(UserPrincipalName)),
        Name = tostring(split(UserPrincipalName, "@")[0]),
        UPNSuffix =tostring(split(UserPrincipalName, "@")[1]))
    on $left.DestinationIP == $right.IPAddress and $left.SourceUserName == $right.UserPrincipalName
| where SigniningTime between ((AlertTime - 6h) .. (AlertTime + 6h)) and 3plogTime between ((AlertTime - 6h) .. (AlertTime + 6h))

YAML

severity: Medium
name: M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity
requiredDataConnectors:
- dataTypes:
  - SecurityAlert
  connectorId: OfficeATP
- dataTypes:
  - CommonSecurityLog (PaloAlto)
  connectorId: PaloAltoNetworks
- dataTypes:
  - CommonSecurityLog (Fortinet)
  connectorId: Fortinet
- dataTypes:
  - CommonSecurityLog (CheckPoint)
  connectorId: CheckPoint
- dataTypes:
  - CommonSecurityLog (Zscaler)
  connectorId: Zscaler
id: 779731f7-8ba0-4198-8524-5701b7defddc
tactics:
- PrivilegeEscalation
queryFrequency: 1d
triggerOperator: gt
metadata:
  author:
    name: Arjun Trivedi
  support:
    tier: Community
  categories:
    domains:
    - Security - Threat Protection
  source:
    kind: Community
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/SucessfullSiginFromPhingLink.yaml
description: |
    'This content is employed to correlate with Microsoft 365 Defender phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.'
triggerThreshold: 0
kind: Scheduled
relevantTechniques:
- T1078
query: |
  let Alert_List= dynamic([
  "Phishing link click observed in Network Traffic",
  "Phish delivered due to an IP allow policy",
  "A potentially malicious URL click was detected",
  "High Risk Sign-in Observed in Network Traffic",
  "A user clicked through to a potentially malicious URL",
  "Suspicious network connection to AitM phishing site",
  "Messages containing malicious entity not removed after delivery",
  "Email messages containing malicious URL removed after delivery",
  "Email reported by user as malware or phish",
  "Phish delivered due to an ETR override",
  "Phish not zapped because ZAP is disabled"]);
  SecurityAlert
  | where AlertName in~ (Alert_List)
  //Findling Alerts which has the URL
  | where Entities has "url"
  //extracting Entities
  | extend Entities = parse_json(Entities)
  | mv-apply Entity = Entities on
      (
      where Entity.Type == 'url'
      | extend EntityUrl = tostring(Entity.Url)
      )
  | summarize
      Url=tostring(tolower(take_any(EntityUrl))),
      AlertTime= min(TimeGenerated),
      make_set(SystemAlertId, 100)
      by ProductName, AlertName
  // matching with 3rd party network logs and 3p Alerts
  | join kind= inner (CommonSecurityLog
      | where DeviceVendor has_any  ("Palo Alto Networks", "Fortinet", "Check Point", "Zscaler")
      | where DeviceProduct startswith "FortiGate" or DeviceProduct startswith  "PAN" or DeviceProduct startswith  "VPN" or DeviceProduct startswith "FireWall" or DeviceProduct startswith  "NSSWeblog" or DeviceProduct startswith "URL"
      | where DeviceAction != "Block"
      | where isnotempty(RequestURL)
      | project
          3plogTime=TimeGenerated,
          DeviceVendor,
          DeviceProduct,
          Activity,
          DestinationHostName,
          DestinationIP,
          RequestURL=tostring(tolower(RequestURL)),
          MaliciousIP,
          SourceUserName=tostring(tolower(SourceUserName)),
          IndicatorThreatType,
          ThreatSeverity,
          ThreatConfidence,
          SourceUserID,
          SourceHostName)
      on $left.Url == $right.RequestURL
  // matching successful Login from suspicious IP
  | join kind=inner (SigninLogs
      //filtering the Successful Login
      | where ResultType == 0
      | project
          IPAddress,
          SourceSystem,
          SigniningTime= TimeGenerated,
          OperationName,
          ResultType,
          ResultDescription,
          AlternateSignInName,
          AppDisplayName,
          AuthenticationRequirement,
          ClientAppUsed,
          RiskState,
          RiskLevelDuringSignIn,
          UserPrincipalName=tostring(tolower(UserPrincipalName)),
          Name = tostring(split(UserPrincipalName, "@")[0]),
          UPNSuffix =tostring(split(UserPrincipalName, "@")[1]))
      on $left.DestinationIP == $right.IPAddress and $left.SourceUserName == $right.UserPrincipalName
  | where SigniningTime between ((AlertTime - 6h) .. (AlertTime + 6h)) and 3plogTime between ((AlertTime - 6h) .. (AlertTime + 6h))  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Name
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
- entityType: IP
  fieldMappings:
  - columnName: DestinationIP
    identifier: Address
- entityType: DNS
  fieldMappings:
  - columnName: DestinationHostName
    identifier: DomainName
- entityType: Host
  fieldMappings:
  - columnName: SourceSystem
    identifier: FullName
- entityType: URL
  fieldMappings:
  - columnName: RequestURL
    identifier: Url
version: 1.0.3
queryPeriod: 1d

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/779731f7-8ba0-4198-8524-5701b7defddc')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/779731f7-8ba0-4198-8524-5701b7defddc')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity",
        "description": "'This content is employed to correlate with Microsoft 365 Defender phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let Alert_List= dynamic([\n\"Phishing link click observed in Network Traffic\",\n\"Phish delivered due to an IP allow policy\",\n\"A potentially malicious URL click was detected\",\n\"High Risk Sign-in Observed in Network Traffic\",\n\"A user clicked through to a potentially malicious URL\",\n\"Suspicious network connection to AitM phishing site\",\n\"Messages containing malicious entity not removed after delivery\",\n\"Email messages containing malicious URL removed after delivery\",\n\"Email reported by user as malware or phish\",\n\"Phish delivered due to an ETR override\",\n\"Phish not zapped because ZAP is disabled\"]);\nSecurityAlert\n| where AlertName in~ (Alert_List)\n//Findling Alerts which has the URL\n| where Entities has \"url\"\n//extracting Entities\n| extend Entities = parse_json(Entities)\n| mv-apply Entity = Entities on\n    (\n    where Entity.Type == 'url'\n    | extend EntityUrl = tostring(Entity.Url)\n    )\n| summarize\n    Url=tostring(tolower(take_any(EntityUrl))),\n    AlertTime= min(TimeGenerated),\n    make_set(SystemAlertId, 100)\n    by ProductName, AlertName\n// matching with 3rd party network logs and 3p Alerts\n| join kind= inner (CommonSecurityLog\n    | where DeviceVendor has_any  (\"Palo Alto Networks\", \"Fortinet\", \"Check Point\", \"Zscaler\")\n    | where DeviceProduct startswith \"FortiGate\" or DeviceProduct startswith  \"PAN\" or DeviceProduct startswith  \"VPN\" or DeviceProduct startswith \"FireWall\" or DeviceProduct startswith  \"NSSWeblog\" or DeviceProduct startswith \"URL\"\n    | where DeviceAction != \"Block\"\n    | where isnotempty(RequestURL)\n    | project\n        3plogTime=TimeGenerated,\n        DeviceVendor,\n        DeviceProduct,\n        Activity,\n        DestinationHostName,\n        DestinationIP,\n        RequestURL=tostring(tolower(RequestURL)),\n        MaliciousIP,\n        SourceUserName=tostring(tolower(SourceUserName)),\n        IndicatorThreatType,\n        ThreatSeverity,\n        ThreatConfidence,\n        SourceUserID,\n        SourceHostName)\n    on $left.Url == $right.RequestURL\n// matching successful Login from suspicious IP\n| join kind=inner (SigninLogs\n    //filtering the Successful Login\n    | where ResultType == 0\n    | project\n        IPAddress,\n        SourceSystem,\n        SigniningTime= TimeGenerated,\n        OperationName,\n        ResultType,\n        ResultDescription,\n        AlternateSignInName,\n        AppDisplayName,\n        AuthenticationRequirement,\n        ClientAppUsed,\n        RiskState,\n        RiskLevelDuringSignIn,\n        UserPrincipalName=tostring(tolower(UserPrincipalName)),\n        Name = tostring(split(UserPrincipalName, \"@\")[0]),\n        UPNSuffix =tostring(split(UserPrincipalName, \"@\")[1]))\n    on $left.DestinationIP == $right.IPAddress and $left.SourceUserName == $right.UserPrincipalName\n| where SigniningTime between ((AlertTime - 6h) .. (AlertTime + 6h)) and 3plogTime between ((AlertTime - 6h) .. (AlertTime + 6h))\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078"
        ],
        "alertRuleTemplateName": "779731f7-8ba0-4198-8524-5701b7defddc",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "Name"
              },
              {
                "identifier": "UPNSuffix",
                "columnName": "UPNSuffix"
              }
            ],
            "entityType": "Account"
          },
          {
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "DestinationIP"
              }
            ],
            "entityType": "IP"
          },
          {
            "fieldMappings": [
              {
                "identifier": "DomainName",
                "columnName": "DestinationHostName"
              }
            ],
            "entityType": "DNS"
          },
          {
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "SourceSystem"
              }
            ],
            "entityType": "Host"
          },
          {
            "fieldMappings": [
              {
                "identifier": "Url",
                "columnName": "RequestURL"
              }
            ],
            "entityType": "URL"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/SucessfullSiginFromPhingLink.yaml",
        "templateVersion": "1.0.3"
      }
    }
  ]
}